v0.4.3 — discoverability metadata sweep

Discoverability metadata sweep — no code changes, just making the project findable.

Changed

• package.json: description rewritten to reflect 0.4 reality (security, MCP, file recovery, multi-tool — not just image cleanup). keywords expanded from 9 to 25, covering every supported tool name + every primary capability + the MCP / security framing. Added homepage pointing at the GitHub repo.
• GitHub repo metadata: description matches the npm one. Homepage points to the npm package page. 15 topics added covering tools, capabilities, and tech stack — none were set previously, so the repo wasn't appearing in GitHub topic browses or "related repositories" suggestions.

v0.4.2 — Reclaim Needs Attention card uses live scan cache

Fixed

• Reclaim "Needs attention" card read a stale per-session secretCount placeholder (always 0) instead of the live scan cache. Now reads scan.totalFindings and scan.sessionsWithFindings so it matches the sidebar count and the Security page.

v0.4.1 — docs sweep, README rewrite, repo cleanup

Docs sweep, README rewrite, repo cleanup. No code changes other than the version bump and a small script under tools/.

Added

• tools/generate-llms-txt.mjs — regenerates llms.txt by concatenating every page referenced from docs/src/SUMMARY.md in order. Run after any docs change.
• docs/src/reclaim.md, security.md, connect.md, backups.md, session-detail.md — new pages for the post-rebuild UI surfaces.

Changed

• README rewritten for 0.4.0 reality: drops the "before Claude tells you images are too big" framing, leads with the four things ConClear actually does (reclaim, redact, recover, MCP bridge), adds the security loop section, updates the capability matrix and MCP tools list, refreshes keyboard shortcuts to match the rebuild.
• skill.md — adds conclear scan to the command table and conclear_files / conclear_scan_secrets to the MCP surface so agents reading the skill see the full toolset.
• docs/src/ — web-ui.md, secret-scanning.md, mcp-server.md, operations.md, supported-tools.md, introduction.md, what-is-conclear.md, and per-tool pages for Cline / Cursor / Gemini all updated to reflect 0.4.0 capability parity. SUMMARY restructured: top-level pages now cover the post-rebuild UI (Reclaim / Sessions / Security / Connect / Backups) and session-detail tabs are grouped separately.
• llms.txt regenerated from the new docs.

Removed

• docs/screenshots/v0.2/ and docs/screenshots/demo-*.png — pre-rebuild UI captures the README had been pointing at. Fresh 0.4 captures will land separately.
• docs/src/disk-usage.md — content folded into reclaim.md and backups.md.

Git history

Every commit prior to this release was rewritten to strip Co-Authored-By: Claude * and Generated with Claude Code lines. GitHub renders those as collaborators on the repo contributor list, which had caused real social friction. The factual product references in commit prose ("Claude Code JSONL parser", etc.) were preserved — those describe what ConClear supports.

v0.4.0 — adapter parity, restore-from-backup, rotate nudges

Closes the security loop end-to-end and brings every adapter except Copilot up to capability parity for the things that actually matter (scan / redact / export). The single biggest gap from earlier releases — "ConClear's interesting features only work on Claude Code sessions" — is closed.

Added

• Cline scan + redact + export. scanClineSecrets, redactClineSecrets, exportClineMarkdown walk the Anthropic-shaped api_conversation_history.json, scan every text / tool_use / tool_result block, and pretty-print the JSON back when redacting.
• Gemini scan + redact + export. Handles string content, { text } objects, and parts[] arrays. Redact preserves the file shape.
• Cursor scan. Walks every bubble in a composer (text + toolFormerData.rawArgs + result) via the existing read-only SQLite handle. Redact for Cursor is intentionally deferred — rewriting SQLite blobs while Cursor is running is risky and the rotate-the-credential workflow (via the rotate links shipped this release) covers the user need.
• MCP tools conclear_scan_secrets + conclear_files. Agents can now scan a session for leaked credentials and list files touched, without going through the web UI. Both honestly degrade for adapters that don't support the capability.
• Rotate-this-key links. Every Security finding shows a "Rotate at provider X" link next to the redact button. Known mappings: OpenAI / Anthropic, AWS IAM, GitHub tokens, GitHub SSH keys. Bearer / database / webhook / env credentials fall back to a "rotate the credential" label with no link, since the provider is ambiguous.
• Restore-from-backup. POST /api/backups/:name/restore reads a sidecar metadata file written alongside each backup and copies it back over the original session file. Backups page shows the action that produced the backup (strip / resize / redact) and the original path; legacy backups (pre-0.4) get a disabled Restore button with an explanatory tooltip.
• First-run onboarding banner. When no clients are MCP-installed yet, Reclaim shows a one-shot prompt that links to Connect with the bulk-install primed. Dismissable; remembered in localStorage.
• README badges — npm version, monthly downloads, CI status, license.
• CHANGELOG entries for 0.3.0 and 0.3.1 (previously skipped).

Changed

• Shared secret-scanning module (src/server/adapters/secrets.ts). The pattern table, redactSecret, extractContext, scanText, redactText, and sortFindings are now one source of truth used by every adapter. The Claude parser still owns its JSONL streaming loop but delegates the matching itself.
• Backups now write a .meta.json sidecar containing { origPath, action, createdAt }. Lets the Backups page surface what each backup is and where it came from, and powers Restore. Sidecars are filtered out of the listing so they don't appear as their own entries.
• Capability matrix updated to reflect adapter parity: Cursor / Gemini / Cline gain scanSecrets; Gemini / Cline gain exportSession.

Tests

• 17 new test cases across Claude (existing), Cline, and Gemini redact pipelines: pattern coverage, line filter, type filter, content-shape preservation, scan-after-redact validation. 38 tests total (was 21 before 0.3.1).

Known limitations

• Cursor redact not implemented. Use the rotate links to roll the credential; delete the session inside Cursor itself if you want the data gone.
• Copilot Chat remains read-only: parser exists but no scan / redact / export. Lower priority — Copilot's data is the smallest of the five and rarely contains pasted credentials in the wild.
• Windsurf still install-only (chats are encrypted protobuf).

v0.3.1 — redact, scan cache, instant first paint

End-user polish pass on top of 0.3.0 — fixes things you notice within the first minute of using the app.

Added

• Working bulk + per-finding redact. redactSecretsInFile parser, redactSecrets adapter method (Claude), and POST /api/sessions/:id/redact route. Every redact writes a verified timestamped backup to ~/.conclear/backups/ before rewriting the session file. UI: "Redact all" on both the global Security page and the per-session Security tab; scissors button on every finding row to redact just that line.
• Shared scan cache. Module-level singleton store backs the sidebar Security count, the global Security page, the per-session Security tab, and the SessionDetail header badge. No more rescanning every time you navigate. Rehydrates from localStorage on cold start so something paints instantly.
• Sessions list cached on first paint. useSessions hydrates from localStorage (conclear.sessions.v1) before the network round-trip; background refresh updates when ready. Errors no longer wipe the cached list.
• Real image thumbnails. Images tab and lightbox render from /api/sessions/:id/images/:imageId instead of colored gradient placeholders. Stripped images still fall back to a gradient.

Changed

• Timeline paginates at 200 rows. Huge sessions no longer trigger Firefox's "page slowing down" warning. "Show N more" button to expand. Non-expandable rows now render with cursor: default so the click affordance is honest.
• Claude project directories decoded for display. -Volumes-4tbCache--Projects-ConClear → ConClear in session group headers, overview lists, and detail view. The raw form is still used as the internal key.
• Titlebar MCP chip no longer claims "running." ConClear's MCP server is spawned on demand by each client; the chip now reflects that and links to Connect.
• Sidebar Security count flips to alert styling when findings > 0.

Fixed

• Per-session Security tab re-scanned every visit. It now reads from the shared cache and only fetches when uncached.